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6 Abstract 

This paper presents a novel efficient chaotic image encryption scheme, in which the temp-value 
feedback mechanism is introduced to the permutation and diffusion procedures. Firstly, a simple 

C^ trick is played to map the plain-image pixels to the initial condition of the Logistic map. Then, 

a pseudorandom number sequence (PRNS) is obtained from iterating the map. The permutation 

O procedure is carried out by a permutation sequence which is generated by comparing the PRNS and 

<^ its sorted version. The diffusion procedure is composed of two reversely executed rounds. During 

each round, the current plain-image pixel and the last cipher-image pixel are used to produce the 
current cipher-image pixel with the help of the Logistic map and a pseudorandom number generated 
by the Chen system. To enhance the efficiency, only expanded XOR operation and modulo 256 
addition are employed during diffusion. Experimental results show that the new scheme owns a 
large key space and can resist the differential attack. It is also efficient. 
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8 1. Introduction 

p\| 9 In the information era, digital images have been widely used for various applications, such as 

■^ 10 entertainment, business, health service and military affairs, etc. All the sensitive data should be 

^^ n encrypted before transmission to avoid eavesdropping. However, bulk data size and high redun- 

^ 12 dancy among the raw pixels of a digital image make the traditional encryption algorithms, such 

r* 13 as DES, IDEA, AES, not able to be operated efficiently. Therefore, designing specialized encryp- 

. ^H 14 tion algorithms for digital images has attracted much research effort. Some intrinsic properties 

/\ 15 of chaotic systems, such as ergodicity, sensitive to the initial condition and control parameters, 

j^ 16 are analogous to the confusion and diffusion properties designed by Shannon |lj. Thus makes it 



17 natural to employ chaotic systems in image encryption algorithms [2H10J. Meanwhile, the art of 

18 deciphering has also made new achievements in the last few decades. Some of the existing image 

19 encryption algorithms are found insecure |lH - tl8j to different degrees due to the following defects: 

20 1) the (equivalent) secret key can be obtained by the brute-force attack due to the dynamical 

21 degradation of chaotic systems in digital domain; 2) all the operations employed in the encryption 

22 process are reversible or even linear, therefore the mathematical model of the scheme is not a keyed 



* Corresponding author. 
Email address: leoxtuOgmail . com (Leo Yu Zhang) 



Preprint submitted to Communications in Nonlinear Science and Numerical Simulation April 10, 2013 



23 one-way function [19] . In [20] , some basic requirements for evaluating the chaotic image encryption 

24 algorithm are concluded. 

25 The permutation-diffusion structure becomes the basis of many chaotic image encryption schemes 

26 since Fridrich developed a chaos-based image encryption scheme of this structure in 1998 [2j. The 

27 symmetric image encryption scheme in [1] extended the Cat map to three-dimensional to make 

28 it suitable for permutation in space and followed the similar diffusion construction of Fridrich's. 

29 In 2004, Mao et al. proposed an image encryption algorithm, where the discrete Baker map was 

30 employed for permutation [8j. It's worth mentioning that most image encryption schemes of this 

31 structure have to execute the permutation and diffusion procedures alternatively several rounds to 

32 fulfill the security requirement, which will certainly lead to some reduction in efficiency. Nonethe- 

33 less, Solak et al. proposed a chosen ciphertext attack in 2010 by utilizing the relationship between 

34 the pixels in the neighboring encryption rounds [12]. This attack is efficient to Fridrich's scheme 

35 [2] and it can also be applied to Chen's scheme [1]. In addition, it is reported in [21] that the 

36 equivalent key of several permutation-diffusion image ciphers, such as the schemes suggested in 

37 [21 m [SI [22], can be recovered when only one iteration round is applied. 

38 Meanwhile, image encryption algorithms of other structures have also been developed. In 2010, 

39 Patidar et al. suggested a substitution-diffusion structure for color image [TU], which was attacked 

40 in [18j. In [9j, Huang et al. presented a multi-chaotic system based permutation scheme [9], in 

41 which pixel positions and bits in the individual pixel are shuffled together to achieve permuta- 

42 tion and substitution simultaneously. Intuitively, permutation-only schemes are not secure against 

43 known/chosen plaintext attack. In |13|ll7j. Li et al. proposed the quantitative and optimal quan- 

44 titative cryptanalysis of the permutation-only encryption schemes with respect to known/chosen 

45 plaintext attack. 

46 By combining the Chen system and the Logistic map, a novel permutation-diffusion image en- 

47 cryption algorithm is given in this paper. To resist the known attacks and achieve better efficiency, 

48 two temp-value feedback mechanisms are imbedded into a single permutation-diffusion round. In 

49 the permutation part, we develop different permutation sequences for different plain- images by 

50 means of mapping some information of the plain-image to the generation process of the permuta- 

51 tion sequence. Thus makes the permutation acts in a "one time pad" manner. In the diffusion part, 

52 another feedback technique is employed to make the equivalent key generation depend on both the 

53 plain-image and the temp-value. By combining the proposed permutation and diffusion technique, 

54 the scheme frustrates the known attacks |121I21|. In addition, we add a reversely executed diffusion 

55 process to make the scheme sensitive to changes of plain-image. 

56 The rest of this paper is organized as follows. Section [2] presents some descriptions of the pre- 

57 requisites of the algorithm, such as expanded XOR operation, the temp- value feedback mechanism, 

58 followed by the detailed encryption/decryption procedures. In Sec. [SJ we evaluate the new scheme 

59 via numerical simulations and comparisons. The last section gives some concluding remarks. 

60 2. The proposed image encryption algorithm 

61 2.1. The involved chaotic systems 

62 Chen system has been widely adopted in many chaotic image encryption algorithms, it can be 

63 modeled by [4j 

x = a(y-x), 

y = (c — a)x — xz + cy, (1) 

z = xy — bz, 

2 



64 where a, b and c are system parameters. When a = 35, 6 = 3 and c G [20,28.4], the system is 

65 chaotic. In the proposed encryption algorithm, c is fixed at 28. 

The other chaotic system employed in this encryption algorithm is the Logistic map 

yn+i = /i-y„ • (1 -Vn), 

66 where yn S (0, 1) and /u is the control parameter. When /u G (3.5699456,4), the output sequence is 

67 ergodic in the unit interval (0, 1), which makes the Logistic map suitable for pseudorandom number 

68 generation [23] . 



69 2.2. The expanded XOR operation 

The expanded XOR (eXOR) operation is introduced to enhance the whole security level of the 
scheme. For two inputs x = X]j=o ^i ^^"^ '^ ~ Z^i-" '^'^ 



yi=0 '«' 
7 



eXOR(x, r) = Y2 fiot{xi r j rj+i) • 2' 



i=0 

70 where not{x) flips a single bit x. Then one can deduce a property of eXOR as follows. 
Property 1. If the equation 



eXOR(x, r) = t 

holds, then 

eXOR(t,r) = x. 



: Proof. This property can be proved by checking every bit of eXOR(x, r) and eXOR(t, r), which is 
given in table [T] 

Table 1: The result of not(xi © r; ® '"i+i). 

Tiri+i 
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75 2.3. The temp-value feedback mechanism 

76 The core of the proposed encryption algorithm, two feedback techniques called plaintext feed- 

77 back in permutation and plaintext/ciphertext feedback in diffusion, will be introduced in the fol- 

78 lowing sections. 



79 2.3.1. Plaintext feedback in permutation 

80 Permutation is a basic component of both traditional and chaos-based encryption algorithms. 

81 In the traditional encryption schemes, such as DES and AES, the permutation tables employed 

82 are fixed during designing. While most chaos-based schemes, such as the schemes in [21 SJ [5l E], 

83 apply key-dependent permutation sequence. But all of them have one feature in common: the 

84 permutation sequences (tables) are fixed once the secret key is given. By introducing the plaintext 

85 feedback technique, we develop a new approach to design dynamic permutation sequence, i.e., 

86 different plain-images corresponding to different permutation sequences, thus makes permutation 

87 executes in a "one time pad" manner. The basic process of our method can be described as follows. 

Without loss of generality, denote an 8-bit sequence and its permutated version by {ai}^^^ and 
{a^}"^]^, respectively. For any i E {1, 2, • • • , n}, permutation only makes change to the position of 
Oj while keeps its value fixed, then one has 

max(aj) = max(a9, 

n n 



i=l i=l 



Set 



fo, if max(ai) = 0, 

^°= ^H^ = ^H<, otherwise, ^'^ 

Note that yo = or ijq = 1 if and only if Oj = c, where i £ {1, 2, • • • , n} and c is a constant, 
the permutation can be simply ignored when this situation occurs during encryption. Iterate 
a nonlinear function m = f{yi-i,u) from yo for n times to obtain a PRNS {yj}f=i. Then a 
permutation sequence {si}^^^ is derived by comparing {yi}"^^ ^^"^ i*^ sorted version, where y^i is 
the i-th largest element in the sequence {yj}"=i. To get the permutated sequence {a'j}^^i, simply 
set 

a- = 0^,. 

89 It should be noticed that the inverse permutation shares the same structure of the original 

90 one because Eq. ([2| always holds. In the proposed permutation, some information of the original 

91 sequence {oj}"^^ is mapped to the initial value of the nonlinear function. Then one can develop 

92 different permutation sequences {si}f^i for different plain-images. Thus makes this kind of per- 

93 mutation tough for the known/chosen plaintext attack proposed in J13l I17j . In the suggested 

94 encryption algorithm, the Logistic map serves as the nonlinear function and its parameter /i is 

95 considered as part of the secret key. For the sake of larger key space, one can employs nonlinear 

96 function with more control parameters after careful study. 

97 2. 3. 2. Plaintext/ ciphertext feedback in diffusion 

98 The diffusion procedure presented in this scheme is composed of two rounds, which are denoted 

99 by Diffusion I and Diffusion II, respectively. In Diffusion I, we first calculate the equivalent secret 

100 keys according to the gray value of the last plain-image pixel. Then the current cipher-image 

101 pixel can be obtained by combining the current plain-image pixel, the last cipher-image pixel and 

102 the current equivalent keys together with the help of the above mentioned eXOR operation and 

103 modulo 256 addition. Namely, each pair of equivalent keys are produced by using the plaintext 

104 feedback technique and every cipher-image pixel is calculated by using the ciphertext feedback 



105 technique. Diffusion II owns the same structure as Diffusion I but execute reversely, thus makes 

106 the diffusion procedure sensitive to changes of plain-image. Suppose an 8-bit PRNS {xjJ^^q is 

107 available, one can compute the cipher-image pixel sequence {cj}"^^ from {pi}f^i as follows. 

108 • Diffusion I: Set po = x„, ttiq = Xn+i and i = 1, get {?n,j}"^^ by the following steps. 

109 — Obtain the initial condition tq of the Logistic map by 

f(xi_i + 127)/(pi_i + 255), [fxi-i<pi-i, ,^, 

I {pi~i + 127)/(xj_i -|- 255), otherwise. 

110 — Iterate the Logistic map twice from tq to obtain r and f', refresh them with Eq. Q and 

111 denote the result by r and r', respectively. 

g{x) = [x ■ lO^J mod 512, (4) 

112 where [x\ returns the nearest integers smaller than or equal to x. 

113 — Compute rui by 

rui = eXOR(pi,r) + eXOR(mi_i,r'), (5) 

114 where a -\-b = (a + b) mod 256. 

115 — Let i = i + 1, execute the above three steps for n — 1 more times and get {ttt-j}"^]^. 

• Diffusion II: Similar to Diffusion I, one can obtain {cj}"^^ by diffuse {mj}"^^ in a reverse 
order. Set m,„+i = Xn+s, c„+i = Xn+2, for i = n ~ 1, Diffusion II is the same as Diffusion I 
except Eq. ([s]) and Eq. ^ are replaced by 

J {xn-i + 127)/(mj+i + 255), if Xn-i < nn+i, 
I (rrij+i -|- 127) / {xn-i + 255), otherwise, 



and 



respectively. 



a = eXOR(mi,r) -heXOR(ci+i,r'), (6) 



118 2.4- Encryption algorithm 

119 Combining the above mentioned two kinds of temp- value feedback techniques, a novel symmet- 

120 ric gray image encryption scheme is presented in this section. Without loss of generality, one can 

121 scan a plain-image in the raster order and represent it as a one-dimensional 8-bit sequence {piJiLi- 

122 Given the secret key K = (x,y,z,/i), where {x,y,z) is the initial conditions of the Chen system 

123 and /i E (3.5699456, 4) is the control parameter of the Logistic map, the details of the encryption 

124 procedure are described as follows. 

• Step (1) Initialization: Implement the Chen system M with the fourth-order Runge-Kutta 
method of step length h = 0.001 iteratively for 1000-1- [(n-|-4)/3] times from {x,y,z). Get a 
real number sequence {-Zi}"^o ^^ combining the later \{n + 4)/3] approximate states of the 
Chen system. Generate an 8-bit PRNS {xi}"^Q from {zjJ^^q by using 

Xi = [dec(|zi|) • lO^J mod 256, 

125 where \x\ and dec(x) return the absolute value and the fractional part of x, respectively. 



126 • Step (2) Permutation: Permutate the plaintext sequence {pi}^^i as described in Sec. 2.3.1 

127 and denote the sequence after permutation with {Pi}"=x, the nonhnear function adopted here 

128 is the Logistic map. 



129 • Step (3) Diffusion: Given the PRNS {xj}^^q , diffuse {p'j}"=i as described in Sec. 

130 obtain the ciphertext sequence {q}"^]^. 



2.3.2 



to 



131 2.5. Decryption algorithm 

The decryption procedures are similar to those of encryption except the following modifications: 
1) Permutation and Diffusion are executed in a reverse order, 2) Diffusion I and Diffusion II should 
be executed reversely, 3) Referring to property [T| Eq. ^ and Eq. ^ should be replaced with 

Pi = eX0R(?TT,j—eX0R(7Tij_i, r'),r) 

and 

rui = eXOR(cj— eXOR(cj+i,r'),r), 

132 where a—h = (a — b) mod 256. 

133 3. Security and efficiency analysis 

134 3.1. Analysis of key space 

135 It is recommended in |2U| that the key space of a chaos-based encryption system should be 



136 more than 2^'''^ ~ 10^'' to resist the brute-force attack. As described in Sec. 2.4, the secret key of 

137 the suggested scheme is the double-precision floating-point representation of the initial condition of 

138 the Chen system and the control parameter of the Logistic map, i.e., K = (x, y, z, /i). The number 

139 of significant digits in each parameter is 15, it is concluded that the key space is (10^^)'^ = 10^*^, 

140 which is much larger than the recommended size of a secure cipher. 

141 3.2. Differential analysis 

142 Differential analysis aims to obtain some information of the (equivalent) secret key of an en- 

143 cryption algorithm by means of observing how differences in input can affect the resultant output. 

144 To implement the differential analysis in image encryption system, the opponent can encrypt two 

145 chosen plain- images with minor modifications, e.g., a slight change of one pixel, then compare the 

146 encrypted results. If the minor modification of the plain-image generates significant and unpre- 

147 dictable results in the cipher-image, this attack will become inefficient. 

To give a quantitative description of the one-pixel change on the encrypted results, two common 
measures NPCR (number of pixels change rate) and UACI (unified average changing intensity) are 
used. They are defined by 

DjiJ) 
xW 



NPCR = y ili^l^ X 100% 



and 



UACI = -1- Y. \CA^,^)-C2{^,J)\ ^ 
H xW ^-' 255 



where Ci and C2 are two H x W (height x width) cipher-images corresponding to plain- images 
differing in one single pixel, Ci{i,j)/C2{i,j) is the gray-scale value of C1/C2 at grid (i, j) and D 
is a matrix defined by 

Jo, ifCi{i,j) = C2{i,j), 

II, otherwise. 

148 It is reported in [6] that the expected NPCR and UACI values of a 256 gray-scale image are 

149 99.6094% and 33.4635%, respectively. 

The tests of the proposed scheme are carried out as follows. Given a plain- image Pi, randomly 
choose grid {i,j) and obtain P2 with 

/Pi(i,j) + 1, ifPi(i,i)<255, 
I 254, otherwise. 

150 Encrypt them and denote the cipher-image by Ci and C2, then one can calculate NPCR and UACI 

151 as described above. Given the secret key K = (3.0,4.0,5.0,3.999), repeat this test 200 times, we 

152 found that the mean of NPCR and UACI values are 99.6041% and 33.4198%, respectively, which 

153 are very close to their expectation. 

154 3.3. Statistical analysis 

155 3.3.1. Histograms of encrypted images 

156 In Figure [T| we give a typical example of histograms of the plain-image and the corresponding 

157 cipher-image. As shown in Fig. flld), all the gray-scale values of the cipher-image of "Lenna" are 

158 distributed uniformly over the interval [0,255], which is significantly different from the original 

159 distribution shown in Fig. [lib). 

160 3.3.2. Information entropy 

The histogram gives a visual experience of the pixel distribution of cipher-images, while in- 
formation entropy can offer a measure to quantify the random looking distribution. The most 
commonly used information entropy is the Shannon entropy [1], which is regarded as the vital 
feature of randomness. For a message source with 2 symbols nii, its Shannon entropy, H{m), is 

defined as follows: 

2^-1 

H(rn) = — y Pr{mi) ■\og2[Pr{mi)], 
j=0 

161 where Pr{mi) is the probability of the symbol mi which is generated by the source. It is easy 

162 to prove that a true random gray-scale image with uniformly distributed pixel over the interval 

163 [0, 255] can achieve the ideal Shannon entropy 8. Set the secret key K = (2.0, 3.0, 4.0, 3.9876), and 

164 get the cipher-image of "Lenna", "Baboon" and "Pepper" of the same size 256 x 256. The Shannon 

165 entropy of the three cipher-images are -ffLenna = 7.9973, -ffsaboon = 7.9971 and -ffpepper = 7.9969, 

166 which are very close to the ideal value 8. 

167 3. 3. 3. Correlation of adjacent pixels 

The adjacent pixels are strongly correlated is an intrinsic characteristic of digital images with- 
out compression. An effective image encryption algorithm should be able to remove this kind of 
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Figure 1: Histograms of plain-image "Lenna" and its corresponding cipher-image: (a) plain-image "Lenna" ; (b) 
Histogram of "Lenna" ; (c) the cipher-image of "Lenna" ; (d) Histogram of the cipher-image. 



relationship. To test the correlation between horizontally adjacent pixels, vertically adjacent pixels 
and diagonally adjacent pixels, we calculate the correlation coefficient in each direction by 



cov{x,y) 



AT 



>7V 



T,i=iixi-x)- ivi-y) 



M ^1=1 (^ 



N 



hT.i=i{yi-yy 



'N 



168 where x = -^ • '}2i=iXi^ V ~ 7f ' Sill?/*' i^i^yi) is the i-th pair of adjacent pixels in certain 

169 direction and A^ is the total number of the pairs. The result of the correlation coefficients along 

170 the three directions of the plain-image "Lenna" and its corresponding cipher-image under secret 

171 key K = (5.0, 3.0, 4.0, 3.999) are listed in Table ^ It is clear that the correlation is almost reduced 
to after encryption. 



Table 2: Correlation coefficients between the plain-image "Lenna" and the corresponding cipher-image. 



Direction 


Plain-image "Lenna" 


After encryption 


horizontal 


0.93903 


0.00350 


vertical 


0.96812 


0.00247 


diagonal 


0.91352 


0.00107 



173 3.4- Speed performance 

174 We also test the average encryption (decryption) speed of the proposed scheme on a 3.2GHz 

175 Intel Pentium Dual Core CPU with 2GB RAM using VC compiler. Table [3] gives the average speed 



176 of the proposed scheme with respect to images of various size. For comparison, the running speed 

177 of the algorithm suggested in 0] and DES are also listed. The results indicate that this scheme is 

178 performed in a fast manner. 



Table 3: Speed performance 


of the the proposed scheme, 


the scheme 


in [3] and DES algorithm. 


Image size 
(pixels) 


The proposed scheme 

(ms) 


The algorithm 
m (ms) 


in 


DES algorithm (ms) 


256 X 256 


22 




60 






28 


512 X 512 


98 




273 






110 


1024 X 1024 


415 




1180 






445 



179 4. Conclusion 

180 This paper presents a simple but secure chaotic cipher for gray images by improving the familiar 

181 permutation-diffusion structure. As the plaintext feedback technique is used during permutation, 

182 one can develop different permutation sequences for different plain-images, which makes the scheme 

183 immune to known/chosen plaintext attack. The diffusion procedure improves the traditional dif- 

184 fusion procedure by employing a nonlinear operator eXOR and generating equivalent key stream 

185 dynamically. Experimental tests demonstrate that the scheme owns large key space, high secu- 

186 rity and good encryption (decryption) speed. Thus, it is a good candidate for real-time image 

187 encryption application. 
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